Skaffold build using Kaniko on GKE

I'm using Skaffold with a Kaniko build step on GKE and am wondering why the need for the `kaniko-secret`.

If I'm in GKE and the default SA used has permissions to push to my GCR repo why do I need to also supply SA keys via the kaniko-secret?

I see that things are working without the secret if Workload Identity is enabled but what about clusters not yet migrated to Workload Identity? https://github.com/GoogleContainerTools/skaffold/issues/3468

The only way I found to get it working is with the following instructions and `skaffold.yaml`.

### Instructions:
1. Create SA with `Starage Admin`
2. Download keys
3. Rename keys to kaniko-secret
4. `kubectl create secret generic kaniko-secret --from-file=kaniko-secret`

### skaffold.yaml
```yaml
apiVersion: skaffold/v2beta7
kind: Config
metadata:
name: my-image
build:
artifacts:
- image: gcr.io/my-repo/my-image
kaniko:
cache: {}
cluster:
pullSecretName: kaniko-secret
```

How can I make this work with the default SA and not have to add secondary keys?